[Trevor]

Hi all,

The phpBB Group has just released phpBB 2.0.13, which addresses two vulnerabilities reported after the very recent release of 2.0.12. One issue is very serious, as it allows anyone to gain administrative rights for your forums. The other is a full path disclosure. Again, these patches apply only to users of CPG-Nuke 8.2c.

Open includes/phpBB/sessions.php.

Find on line 86:

PHP:

if( $sessiondata['autologinid'] == $auto_login_key )

Replace with:

PHP:

if( $sessiondata['autologinid'] === $auto_login_key )

Open modules/Forums/viewtopic.php.

Find on line 1225:

PHP:

$message = str_replace('\"', '"', substr(preg_replace('#(\>(((?>([^><]+|(?R)))*)\<))#se', "preg_replace('#\b(" . $highlight_match . ")\b#i', '<span style=\"color:#" . $theme['fontcolor3'] . "\"><b>\\\\1</b></span>', '\\0')", '>' . $message . '<'), 1, -1));

Replace with:

PHP:

$message = str_replace('\"', '"', substr(@preg_replace('#(\>(((?>([^><]+|(?R)))*)\<))#se', "@preg_replace('#\b(" . $highlight_match . ")\b#i', '<span style=\"color:#" . $theme['fontcolor3'] . "\"><b>\\\\1</b></span>', '\\0')", '>' . $message . '<'), 1, -1));

You can also download the patched files.

Thanks.

[Yoshi]

Does this go for the same for 8.2b users?

[Jeruvy]

You should apply 8.2c immediately. These updates are defined as critical ONLY for CPGnuke 8.2b.

They are not widespread changes only fixes and security updates so any mod's or themes you are using will not be affected by these patches.

HTH,

[Jeruvy]

Also note: this patch has been exploited also.

These are fixes suggested, but I have not tested.

In usercp_register.php

PHP:

I will let the devs sort this one out. But it does look like a real fix over the last *cough* patch *cough* which really didn't do anything IMHO.

[bist]

so if I have 8.2b i should unpack 8.2c and copy it over my installation?

just wanna be sure

[NanoCaiordo]

Personally I cannot find uesrcp_register.php ...inside which directory I will find it.

[djdevon3]

usercp_register.php

umm where is that file located?

[xfsunoles]

i believe it located in includes/phpBB folder.

[NanoCaiordo]

its does not exist becouse user registration it is not longer done by the forum module but by my account module, something like coppermine registration that is not longer done by coppermine but, again, by my account. so we do not need this patch!

[djdevon3]

That's what I thought. The file does not exist for cpg. Stand-alone only I believe. That doesn't mean that 8.x users shouldn't patch using the code that is applicable. Only the patch dealing with the usercp_register.php doesn't apply to us.

[DaveTomneyUK]

Does the top fix that Trevor posted need adding to CPG-Dragonfly 9.0.2.0 Mainly the viewtopic.php file?

[Trevor]

No